ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 107.172.249.140:443.

Database Entry


IOC ID:1873885
IOC: 107.172.249.140:443
IOC Type :ip:port
Threat Type :botnet_cc
Malware: MoonPeak
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS36352 AS-COLOCROSSING
Country:- US
First seen:2026-08-14 06:20:15 UTC
Last seen:never
UUID:dfee9768-9765-11f1-8a3d-42010aa4000a
Reporter josephgerald
Reward 5 credits from ThreatFox
Tags:DPRK kimsuky MoonPeak Stella
Reference: https://lazarus.day/iocs/107.172.249.140/

Avatar
josephgerald
MoonPeak/XenoRAT (Stella build) TCP panel, DPRK Kimsuky/UAT-5394 cluster. Plaintext config in payload: C2 107.172.249.140:443, AES key from string LactyaCrut_MassEgg_Nuckvao03iY42s25, mutex Dansweit_Hk65-PSAccerdle, client ID 4949857. Fake job-offer LNK lures.